package collect

import (
	"github.com/elastic/beats/winlogbeat/sys"
	win "github.com/elastic/beats/winlogbeat/sys/wineventlog"
	"io"
	"time"
)

//获取Windows安全日志

//参考链接：https://mp.weixin.qq.com/s/rHDJ2tQWEaZLikMt5bgCsw
//Windows会把系统登录日志记录在Windows安全日志里
//可以用事件ID进行筛选，其中登录失败的事件ID为 4625， 而成功的登录ID为 4624

//4624	Successful User Account Login	大部分登录事件成功时会产生的日志
//4625	Failed User Account Login	大部分登录时间失败时会产生的日志(解锁屏幕并不会产生这个日志)
//4672	Logon with Special Privs	特权用户登录成功时会产生的日志，例如我们登录”administrator”，一般会看到一条4624和4672日志一起出现
//4648	Account Login with Explicit Credentials	  一些其他的登录情况，如使用 runas /user 登录除当前以外的其他用户运行程序时，会产生这样的日志。（不过runas命令执行时同时也会产生一条4624日志）


//以集中收集并分析系统的异常登录情况



const (
	renderBufferSize = 1<<14    //16384
	windowsEvtxFile = "C:\\Windows\\System32\\winevt\\Logs\\Security.evtx"
	windowsEvtxFilex32 = "C:\\Windows\\Sysnative\\winevt\\Logs\\Security.evtx"
)

var localAddress = []string{"-","127.0.0.1","::1"}


type Record struct {
	sys.Event
	API string
	XML string
}


type EventLog interface {
	Open(recordNumber uint64) error

	Read() ([]Record, error)

	Close() error
}


type query struct {
	IgnoreOlder time.Duration
	EventId string
	Level string
	Provider []string
}


//var _ EventLog = &winEventLog{}
var first = true

type winEventLog struct {
	query string
	channelName string
	subscription win.EvtHandle
	maxRead int
	lastRead uint64

	render func(event win.EvtHandle, out io.Writer) error
	renderBuf []byte
	outputBuf *sys.ByteBuffer

	logPrefix string
}

//func (l *winEventLog) Open()error{
//
//}

//func (l *winEventLog) Read()([]Record, error){
//
//}

func (l *winEventLog) Close() error{
	return win.Close(l.subscription)
}

//func (l *winEventLog) eventHandles(maxRead int)([]win.EvtHandle, int, error){
//
//}

func (l *winEventLog) buildRecordFromXML(x []byte, recoveredErr error)(){}

//func newWinEventLog(eventID string)(EventLog, error){
//
//}

func GetLoginLog()(resultData []map[string]string){


	return resultData
}


//func getSuccessLog(timestamp int64)(resultData []map[string]string){
//
//}
//
//func getFailedLog(timestamp int64)(resultData []map[string]string){
//
//}



